使用PowerShell生成动态用户凭据实现Basic Auth及PHP脚本配置需求

Got it, let’s build a custom PHP script that checks all your boxes for Basic Auth configuration—dynamic credential generation, managing a cred.php file, and syncing those credentials straight to your Azure Web App’s application settings. Here’s a complete, adaptable solution broken down into manageable parts:

1. Dynamic User Credential Generation #

First, we’ll create a function to generate cryptographically secure usernames and passwords. Skip weak functions like rand()—we’ll use random_bytes() for true randomness:

function generateCredentials() {
    // Generate a unique, random username (adjust the format to fit your needs)
    $username = 'app_user_' . strtolower(bin2hex(random_bytes(4)));
    
    // Create a strong 16-character alphanumeric password
    $password = bin2hex(random_bytes(8));
    
    return [
        'username' => $username,
        'password' => $password
    ];
}

2. Create/Update the cred.php File #

Next, we’ll write these credentials to a cred.php file as constants, so your application can reference them for Basic Auth checks. We’ll handle file write errors with exceptions to catch issues early:

function updateCredFile($credentials) {
    // Build the content for cred.php using heredoc syntax for readability
    $fileContent = <<<PHP
<?php
// Auto-generated Basic Auth credentials (do not edit manually)
define('BASIC_AUTH_USER', '{$credentials['username']}');
define('BASIC_AUTH_PASS', '{$credentials['password']}');
PHP;

    // Write to the file (ensure your script has write permissions for this directory)
    if (file_put_contents('cred.php', $fileContent) === false) {
        throw new Exception('Failed to write credentials to cred.php');
    }
    
    return true;
}

3. Sync Credentials to Azure Web App Settings #

To update your Azure Web App’s application settings, we’ll use the Azure Management API. First, you’ll need a service principal with Website Contributor permissions on your Web App (get these from Azure Active Directory). Here’s the function to handle token retrieval and setting updates:

function syncToAzureWebApp($credentials, $azureConfig) {
    // Step 1: Fetch an Azure access token using your service principal
    $tokenUrl = "https://login.microsoftonline.com/{$azureConfig['tenant_id']}/oauth2/token";
    $tokenPayload = http_build_query([
        'grant_type' => 'client_credentials',
        'client_id' => $azureConfig['client_id'],
        'client_secret' => $azureConfig['client_secret'],
        'resource' => 'https://management.azure.com/'
    ]);

    $tokenContext = stream_context_create([
        'http' => [
            'method' => 'POST',
            'header' => 'Content-Type: application/x-www-form-urlencoded',
            'content' => $tokenPayload
        ]
    ]);

    $tokenResponse = file_get_contents($tokenUrl, false, $tokenContext);
    if (!$tokenResponse) {
        throw new Exception('Failed to retrieve Azure access token');
    }
    $accessToken = json_decode($tokenResponse, true)['access_token'];

    // Step 2: Get existing Web App settings to merge (avoid overwriting all settings)
    $settingsUrl = "https://management.azure.com/subscriptions/{$azureConfig['subscription_id']}/resourceGroups/{$azureConfig['resource_group']}/providers/Microsoft.Web/sites/{$azureConfig['webapp_name']}/config/appsettings?api-version=2022-03-01";
    
    $getSettingsContext = stream_context_create([
        'http' => [
            'method' => 'GET',
            'header' => "Authorization: Bearer $accessToken"
        ]
    ]);

    $existingSettings = json_decode(file_get_contents($settingsUrl, false, $getSettingsContext), true);
    $updatedSettings = array_merge(
        $existingSettings['properties'],
        [
            'BASIC_AUTH_USER' => $credentials['username'],
            'BASIC_AUTH_PASS' => $credentials['password']
        ]
    );

    // Step 3: Push the updated settings back to Azure
    $updatePayload = json_encode(['properties' => $updatedSettings]);
    $updateContext = stream_context_create([
        'http' => [
            'method' => 'PUT',
            'header' => implode("\r\n", [
                "Authorization: Bearer $accessToken",
                'Content-Type: application/json'
            ]),
            'content' => $updatePayload
        ]
    ]);

    $updateResponse = file_get_contents($settingsUrl, false, $updateContext);
    if (!$updateResponse) {
        throw new Exception('Failed to update Azure Web App settings');
    }

    return true;
}

Putting It All Together #

Use this main execution block to run the full workflow. Replace the Azure config values with your actual service principal and Web App details:

// Main script execution
try {
    // Generate new credentials
    $credentials = generateCredentials();
    echo "Generated credentials: Username = {$credentials['username']}, Password = {$credentials['password']}\n";
    
    // Update the local cred.php file
    updateCredFile($credentials);
    echo "Successfully updated cred.php\n";
    
    // Azure configuration (replace with your actual values)
    $azureConfig = [
        'tenant_id' => 'your-azure-tenant-id',
        'client_id' => 'your-service-principal-client-id',
        'client_secret' => 'your-service-principal-client-secret',
        'subscription_id' => 'your-azure-subscription-id',
        'resource_group' => 'your-webapp-resource-group',
        'webapp_name' => 'your-webapp-name'
    ];
    
    // Sync credentials to Azure Web App
    syncToAzureWebApp($credentials, $azureConfig);
    echo "Successfully synced credentials to Azure Web App\n";
} catch (Exception $e) {
    echo "Error encountered: " . $e->getMessage() . "\n";
    exit(1);
}

Key Notes for Production #

• Security: Never hardcode your Azure service principal credentials—store them in environment variables or an Azure Key Vault instead. Also, ensure cred.php is placed outside your web root or blocked via .htaccess to prevent public access.
• Permissions: Verify your service principal has the Website Contributor role assigned to your Web App resource.
• Follow-Up: As you mentioned, automatic FTP upload of missing credentials/auth files will be covered in a separate implementation.

内容的提问来源于stack exchange，提问作者H Bala